

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=dark>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/newtubiao.png">
  <link rel="icon" href="/img/newtubiao.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="Asteri5m">
  <meta name="keywords" content="">
  <meta name="description" content="计算机系统引导过程graph LR a(主板BIOS&lt;br&gt;系统进行&lt;br&gt;自检) &#x3D;&#x3D;&gt; b(&quot;硬盘主&lt;br&gt;引导程序&lt;br&gt;(MBR)&quot;) b &#x3D;&#x3D;&gt; c(&quot;活动分区&lt;br&gt;引导程序&lt;br&gt;(DBR)&quot;) c &#x3D;&#x3D;&gt; d(&quot;操作系统&lt;br&gt;引导">
<meta property="og:type" content="article">
<meta property="og:title" content="PE文件结构简析">
<meta property="og:url" content="http://asteri5m.icu/archives/PE%E6%96%87%E4%BB%B6%E7%BB%93%E6%9E%84%E7%AE%80%E6%9E%90.html">
<meta property="og:site_name" content="Asteri5m">
<meta property="og:description" content="计算机系统引导过程graph LR a(主板BIOS&lt;br&gt;系统进行&lt;br&gt;自检) &#x3D;&#x3D;&gt; b(&quot;硬盘主&lt;br&gt;引导程序&lt;br&gt;(MBR)&quot;) b &#x3D;&#x3D;&gt; c(&quot;活动分区&lt;br&gt;引导程序&lt;br&gt;(DBR)&quot;) c &#x3D;&#x3D;&gt; d(&quot;操作系统&lt;br&gt;引导">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20210916143545905.png">
<meta property="article:published_time" content="2021-10-21T17:06:00.000Z">
<meta property="article:modified_time" content="2021-11-18T07:07:23.700Z">
<meta property="article:author" content="Asteri5m">
<meta property="article:tag" content="CTF">
<meta property="article:tag" content="Reverse">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20210916143545905.png">
  
    <meta name="baidu-site-verification" content="code-GBSY8p4qe6" />
  
  <title>PE文件结构简析 - Asteri5m</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/atom-one-dark.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->

  
<link rel="stylesheet" href="//cdn.jsdelivr.net/npm/aplayer@1.10.0/dist/APlayer.min.css">
<link rel="stylesheet" href="/xm_custom/custom.css">



  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"asteri5m.icu","root":"/","version":"1.8.12","typing":{"enable":true,"typeSpeed":120,"cursorChar":"_","loop":true},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":3},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":"5INqyf5xMrWdsn0whn39qjsu-gzGzoHsz","app_key":"6UTAOxyJnjvDwHX3PJagKMg9","server_url":"https://5inqyf5x.lc-cn-n1-shared.com","path":"window.location.pathname"}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 5.4.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>Asteri5m</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/guestbook/">
                <i class="iconfont icon-note"></i>
                留言板
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" false
         style="background: url('/img/none.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="PE文件结构简析">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2021-10-22 01:06" pubdate>
        2021年10月22日 凌晨
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      3.3k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      10 分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-page-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-page-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">PE文件结构简析</h1>
            
              <p class="note note-info">
                
                  本文最后更新于：4 个月前
                
              </p>
            
            <div class="markdown-body">
              <h1 id="计算机系统引导过程"><a href="#计算机系统引导过程" class="headerlink" title="计算机系统引导过程"></a><strong>计算机系统引导过程</strong></h1><pre><code class=" mermaid">graph LR
a(主板BIOS&lt;br&gt;系统进行&lt;br&gt;自检) ==&gt; b(&quot;硬盘主&lt;br&gt;引导程序&lt;br&gt;(MBR)&quot;)
b ==&gt; c(&quot;活动分区&lt;br&gt;引导程序&lt;br&gt;(DBR)&quot;)
c ==&gt; d(&quot;操作系统&lt;br&gt;引导&lt;br&gt;(如NTLDR)&quot;)
d ==&gt; e(操作系统&lt;br&gt;内核启动)
e ==&gt; f(驱动程序&lt;br&gt;及服务)
f ==&gt; g(系统&lt;br&gt;自启动程序)
</code></pre>

<h1 id="PE文件：可移植的可执行程序"><a href="#PE文件：可移植的可执行程序" class="headerlink" title="PE文件：可移植的可执行程序"></a><strong>PE文件</strong>：可移植的可执行程序</h1><h2 id="PE文件格式与恶意软件的关系"><a href="#PE文件格式与恶意软件的关系" class="headerlink" title="PE文件格式与恶意软件的关系"></a><strong>PE文件格式与恶意软件的关系</strong></h2><ul>
<li><p>文件感染：</p>
<p>使目标PE文件具备[或启动]病毒功能[或目标程序]</p>
<p>但不破坏目标PE文件原有功能和外在形态(如团标)等</p>
</li>
<li><p>病毒代码如何与目标PE文件融为一体</p>
<p>代码植入、控制权获取、及图标更改等</p>
</li>
</ul>
<h2 id="PE文件总体结构"><a href="#PE文件总体结构" class="headerlink" title="PE文件总体结构"></a><strong>PE文件总体结构</strong></h2><table class="mytable">
    <tr align="center">
        <td>1.DOS MZ header</td>
    </tr>
    <tr align="center">
        <td>2.DOS Stub</td>
    </tr>
    <tr align="center">
        <td>3.PE header</td>
    </tr>
    <tr align="center">
        <td>4.Section table</td>
    </tr>
    <tr align="center">
        <td>5-1 Section 1</td>
    </tr>
    <tr align="center">
        <td>5-2 Section 2</td>
    </tr>
    <tr align="center">
        <td>Section …</td>
    </tr>
    <tr align="center">
        <td>5-n Section n</td>
    </tr>
</table> 

<p>MZ-DOS：MZ文件头(0x40+)，定位PE文件头开始位置，也可用于PE文件合法检测。<br>        3C处的值(末4位)：指向PE文件头开始位置。</p>
<p>DOS Stub：小型DOS程序，在DOS下运行会提示“This is program cannot be run in DOS mode”。</p>
<p>PE header：由三部分组成</p>
<ol>
<li><p>字串 “PE\0\0”    (Signature) (0x04):本域为PE标记,可以此识别给定文件是否为有效PE文件</p>
</li>
<li><p>映像文件头(FileHeader)(0x14):包含了关于PE文件物理分布的信息,比如<u>节数目</u>、后续<u>可选文件头大小</u>、<u>机器类型</u>等。</p>
<table>
<thead>
<tr>
<th align="center">顺序</th>
<th align="center">名字</th>
<th align="center">大小(字节)</th>
<th align="center">描述</th>
</tr>
</thead>
<tbody><tr>
<td align="center">1</td>
<td align="center">Machine *</td>
<td align="center">2</td>
<td align="center">机器类型,x86为14CH</td>
</tr>
<tr>
<td align="center">2</td>
<td align="center">NumberOfSection **</td>
<td align="center">2</td>
<td align="center">文件中节的个数</td>
</tr>
<tr>
<td align="center">3</td>
<td align="center">TimeDataStamp</td>
<td align="center">4</td>
<td align="center">生成该文件的时间</td>
</tr>
<tr>
<td align="center">4</td>
<td align="center">PointerToSymbleTable</td>
<td align="center">4</td>
<td align="center">COFF符号表的偏移</td>
</tr>
<tr>
<td align="center">5</td>
<td align="center">NumberOfSymbols</td>
<td align="center">4</td>
<td align="center">符号数目</td>
</tr>
<tr>
<td align="center">6</td>
<td align="center">SizeOFOptionalHeader*</td>
<td align="center">2</td>
<td align="center">可选头的大小</td>
</tr>
<tr>
<td align="center">7</td>
<td align="center">Characteristics *</td>
<td align="center">2</td>
<td align="center">关于文件信息的标记,比如文件是exe还是dll</td>
</tr>
</tbody></table>
</li>
<li><p>可选映像头(OptionalHeader): 定义了PE文件许多关键信息</p>
<ul>
<li>内存镜像加载地址(ImagaBase)</li>
<li>程序入口点(代码从哪里开始执行)</li>
<li>节在文件和内存中的对齐粒度</li>
<li>本程序在内存中的镜像大小、文件头大小等</li>
<li>目录Directory (16项 * 8字节) : <em>每一项对应后面重要的数据结构的开始位置、大小</em></li>
</ul>
<table>
<thead>
<tr>
<th align="center">名字</th>
<th align="center">描述</th>
</tr>
</thead>
<tbody><tr>
<td align="center">AddressOfEntryPoint*<br>(位置: D8H，4字节)</td>
<td align="center">PE装载器准备运行的PE文件的第一条指令的RVA。<br>(病毒感染中通用关键字段)</td>
</tr>
<tr>
<td align="center">ImagaBase<br>(位置: E4H，4字节)</td>
<td align="center">PE文件的优先转载地址。如：如果该值是400000h，<br>PE装载器将尝试把文件虚拟地址空间的400000h处</td>
</tr>
<tr>
<td align="center">SectionAlignment<br>(位置: E8H，4字节)</td>
<td align="center">内存中节对齐的粒度</td>
</tr>
<tr>
<td align="center">FileAlignment<br>(位置: ECH，4字节)</td>
<td align="center">文件中节对齐的粒度</td>
</tr>
</tbody></table>
</li>
</ol>
<h3 id="节表：紧挨着-PE-header-的一个结构数组。"><a href="#节表：紧挨着-PE-header-的一个结构数组。" class="headerlink" title="节表：紧挨着 PE header 的一个结构数组。"></a><strong>节表</strong>：紧挨着 PE header 的一个结构数组。</h3><p>每一个节表对应一个节表项：</p>
<ul>
<li>节名；</li>
<li>节在文件和内存中的开始地址；</li>
<li>长度；</li>
<li>节属性等。</li>
</ul>
<h3 id="节：可执行文件的核心部分。"><a href="#节：可执行文件的核心部分。" class="headerlink" title="节：可执行文件的核心部分。"></a><strong>节</strong>：可执行文件的核心部分。</h3><ul>
<li>代码节</li>
<li>数据节</li>
<li>引入函数节</li>
<li>资源节（如图标）</li>
<li>引出函数节（DLL文件中常见)</li>
<li>重定位节(DLL文件中常见)</li>
</ul>
<hr>
<p>概念解析</p>
<p>ImagaBase: PE文件在内存中的优先装载地址(大部分为400000H)</p>
<p>RVA地址: Relative Virtual Address,相对虚拟地址,它是相对内存中ImagaBase的偏移 </p>
<p>对齐粒度: 按照内存对齐粒度读取到内存，不足的用0填充。<br>            例如:桶的容量为100L,现有367L水,则需要4个桶<br>            文件中节对齐粒度:0x200；    内存中节对齐粒度:0x1000字节。</p>
<p>​    因此在PE文件中有很多“00”字节，恶意程序可以利用这些填充字节。</p>
<hr>
<h3 id="代码节"><a href="#代码节" class="headerlink" title="代码节"></a><strong>代码节</strong></h3><ul>
<li>紧接着节表之后,一般名为 .text或CODE，该节含有程序的可执行代码</li>
<li>每个PE都有代码节</li>
</ul>
<h3 id="已初始化的数据节"><a href="#已初始化的数据节" class="headerlink" title="已初始化的数据节"></a><strong>已初始化的数据节</strong></h3><ul>
<li>一般名为 .data或DATA</li>
<li>已初始化的数据节中放的是在编译时刻就已经确定的数据</li>
</ul>
<h3 id="未初始化的数据节"><a href="#未初始化的数据节" class="headerlink" title="未初始化的数据节"></a><strong>未初始化的数据节</strong></h3><ul>
<li>一般名为 .bbs</li>
<li>节内放油未初始化的全局变量和静态变量</li>
</ul>
<h3 id="引入函数节"><a href="#引入函数节" class="headerlink" title="引入函数节"></a><strong>引入函数节</strong></h3><ul>
<li><p>节名一般为 .rdata</p>
</li>
<li><p>是被程序调用但起执行代码又不在程序中的函数</p>
<ol>
<li>这些函数位于一个或者多个DLL中,在调用这程序中只保留了函数信息,包括函数民及其驻留的DLL名等</li>
<li>动态链接库: 例如kernel32.dll、user32.dll、gdi32.dll等</li>
</ol>
</li>
<li><p>该节含有四个表</p>
<table>
<thead>
<tr>
<th align="center">名字</th>
<th align="center">解释</th>
</tr>
</thead>
<tbody><tr>
<td align="center">IMPORT Address Table</td>
<td align="center">引入地址表</td>
</tr>
<tr>
<td align="center">IMPORT Directory Table</td>
<td align="center">引入目录表</td>
</tr>
<tr>
<td align="center">IMPORT Name Table</td>
<td align="center">引入名称表</td>
</tr>
<tr>
<td align="center">IMPORT Hints&#x2F;Names &amp; DLL Names</td>
<td align="center">引入提示&#x2F;名称和DLL名称</td>
</tr>
</tbody></table>
<ul>
<li><p>IMPORT Address Table（IAT）：引入地址表，DWORD数组[可通过可选文件头中的DataDirectory的第13项定位]</p>
<ul>
<li>在文件中时，其内容与Import Name Table完全一样</li>
<li>在内存中时，每个双字中存放着对应引入函数的地址</li>
</ul>
</li>
<li><p>IMPORT Directory Table由一系列的IMAGE_IMPORT_DESCEIPTOR结构(5字段*4字节)组成</p>
<ul>
<li>结构的数量取决于程序要使用DLL文件的数量，每一个结构对应一个DLL文件</li>
<li>在所以这些结构的最后，由一个内容全为0的IMAGE_IMPORT_DESCRIPTOR结果作为结束</li>
</ul>
</li>
<li><p>IMPORT Name Table，DATA最高位：</p>
<ul>
<li>为0时：表示通过函数名引入，指向 IMPORT Hints&#x2F;Names</li>
<li>为1时：表示通过序号引入函数</li>
</ul>
</li>
<li><p>IMPORT Hints&#x2F;Names &amp; DLL Names 分解说明</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20210916143545905.png" srcset="/img/loading.gif" lazyload></p>
<ul>
<li>IMAGE_IMPORT_BY_NAME结构<ul>
<li>80 00 为Hints，ExitProcess为引入函数名</li>
<li>62 02 为Hints，wsprintfA为引入函数名</li>
<li>9D 01 为Hints，MessageBoxA为引入函数名</li>
</ul>
</li>
<li>DLL names字符串<ul>
<li>kernel32.dll 为dll文件名</li>
<li>user32.dll 为dll文件名</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<h3 id="引出函数节"><a href="#引出函数节" class="headerlink" title="引出函数节"></a><strong>引出函数节</strong></h3><ul>
<li><p>节名一般为 .edata，有时和 .text节合在一起。这是本文件向其他程序提供<em>调用函数的列表、函数所在的地址</em>及<em>具体代码实现</em></p>
</li>
<li><p>关键结构：引出目录表(导出表、输出表)</p>
<p>​    结构解析：</p>
<table>
<thead>
<tr>
<th align="center">序号</th>
<th align="center">位置</th>
<th align="center">名称</th>
<th align="center">大小</th>
<th align="center">解释</th>
</tr>
</thead>
<tbody><tr>
<td align="center">1</td>
<td align="center">00H</td>
<td align="center">Characteristics</td>
<td align="center">4</td>
<td align="center">一般为0</td>
</tr>
<tr>
<td align="center">2</td>
<td align="center">04H</td>
<td align="center">TimeDataStamp</td>
<td align="center">4</td>
<td align="center">文件生成时间</td>
</tr>
<tr>
<td align="center">3</td>
<td align="center">08H</td>
<td align="center">MajorVersion</td>
<td align="center">2</td>
<td align="center">主版本号</td>
</tr>
<tr>
<td align="center">4</td>
<td align="center">0AH</td>
<td align="center">MinorVersion</td>
<td align="center">2</td>
<td align="center">次版本号</td>
</tr>
<tr>
<td align="center"><strong>5</strong></td>
<td align="center"><strong>0CH</strong></td>
<td align="center"><strong>Name</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>指向DLL的名字</strong></td>
</tr>
<tr>
<td align="center"><strong>6</strong></td>
<td align="center"><strong>10H</strong></td>
<td align="center"><strong>Base</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>开始的序列号</strong></td>
</tr>
<tr>
<td align="center"><strong>7</strong></td>
<td align="center"><strong>14H</strong></td>
<td align="center"><strong>NumberOfFunctions</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>AddressOfFunctions 数组的项数</strong></td>
</tr>
<tr>
<td align="center"><strong>8</strong></td>
<td align="center"><strong>18H</strong></td>
<td align="center"><strong>NumberOfNames</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>AddressOfNames 数组的项数</strong></td>
</tr>
<tr>
<td align="center"><strong>9</strong></td>
<td align="center"><strong>1CH</strong></td>
<td align="center"><strong>AddressOfFunctions</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>指向“函数地址”数组—导出地址表</strong></td>
</tr>
<tr>
<td align="center"><strong>10</strong></td>
<td align="center"><strong>20H</strong></td>
<td align="center"><strong>AddressOfNames</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>指向“函数名所在地址”数组—函数名地址表</strong></td>
</tr>
<tr>
<td align="center"><strong>11</strong></td>
<td align="center"><strong>24H</strong></td>
<td align="center"><strong>AddressOfNameOrdinals</strong></td>
<td align="center"><strong>4</strong></td>
<td align="center"><strong>指向“函数索引序列号”数组—函数序列表</strong></td>
</tr>
</tbody></table>
</li>
<li><p>导出地址表 — EXPORT ADDRESS Table，Dword的两种可能含义</p>
<ul>
<li>dwExportRVA，指向导出地址（一般情况）</li>
<li>dwForwarderRVA，指向另外一个DLL中的某个API函数名</li>
</ul>
</li>
<li><p>导出名字表 — EXPORT Name Table，保存指向名字的指针</p>
</li>
<li><p>导出序号表 — EXPORT Ordinal Table，保存的是各导出函数的函数地址在导出地址表的序号</p>
<ul>
<li>为何需要导出地址表？<br>导出函数名字和导出地址表中的地址<font color=red>不是一一对应关系 </font>(Why?)<br>   1.一个函数实现可能有多个名字<br>   2.某些函数没有名字，仅通过序号导出</li>
</ul>
</li>
</ul>
<h1 id="程序调试"><a href="#程序调试" class="headerlink" title="程序调试"></a><strong>程序调试</strong></h1><p>用户态调试：Ollydbg</p>
<p>内核代码调试：Windbg</p>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/Reserve%E5%9F%BA%E7%A1%80%E7%9F%A5%E8%AF%86/">Reserve基础知识</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/CTF/">CTF</a>
                    
                      <a class="hover-with-bg" href="/tags/Reverse/">Reverse</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/archives/%E8%AE%B0%E4%B8%80%E6%AC%A1%E7%BD%91%E7%BB%9C(%E5%B1%80%E5%9F%9F%E7%BD%91)%E7%A8%8B%E5%BA%8F%E9%A1%B9%E7%9B%AE%E5%BC%80%E5%8F%91.html">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">记一次网络(局域网)程序项目开发(一)</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/archives/%E9%B9%A4%E5%9F%8E%E6%9D%AF2021.html">
                        <span class="hidden-mobile">2021鹤城杯</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments" lazyload>
                
                  
                
                
  <div id="valine"></div>
  <script type="text/javascript">
    Fluid.utils.loadComments('#valine', function() {
      Fluid.utils.createScript('https://cdn.jsdelivr.net/gh/HCLonely/Valine@latest/dist/Valine.min.js', function() {
        var options = Object.assign(
          {"appId":"5INqyf5xMrWdsn0whn39qjsu-gzGzoHsz","appKey":"6UTAOxyJnjvDwHX3PJagKMg9","path":"window.location.pathname","placeholder":"输入QQ号我就能获取你的企鹅昵称和头像啦~","avatar":"retro","meta":["nick","mail","link"],"requiredFields":[],"pageSize":10,"lang":"zh-CN","highlight":false,"recordIP":false,"serverURLs":"","emojiCDN":null,"emojiMaps":null,"enableQQ":true,"tagMeta":["博主","小伙伴","访客"],"master":"3bbfd45c0631973d5196327805f62511","friends":["2012b2da9e0852350b42a9c21823f3cf","641f794b535aea2ebe2ad543ec35e2f8"]},
          {
            el: "#valine",
            path: window.location.pathname
          }
        )
        new Valine(options);
        Fluid.utils.waitElementVisible('#valine .vcontent', () => {
          Fluid.plugins.initFancyBox('#valine .vcontent img:not(.vemoji)');
        })
      });
    });
  </script>
  <noscript>Please enable JavaScript to view the comments</noscript>


              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
      <div class="col-lg-7 mx-auto nopadding-x-md">
        <div class="container custom mx-auto">
          <meting-js server="netease" type="playlist" id="5413938648" fixed="true" theme="#aa55ff"></meting-js>
        </div>
      </div>
    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>使用Hexo框架</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>精品Fluid主题</span></a><br> <span id="timeDate">天数载入中</span><span id="times">...</span><br> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- LeanCloud 统计PV -->
        <span id="leancloud-site-pv-container" style="display: none">
            总访问量 
            <span id="leancloud-site-pv"></span>
             次
          </span>
      
      
        <!-- LeanCloud 统计UV -->
        <span id="leancloud-site-uv-container" style="display: none">
            总访客数 
            <span id="leancloud-site-uv"></span>
             人
          </span>
      

    
  </div>


  
  <!-- 备案信息 -->
  <div class="beian">
    <span>
      <a href="http://beian.miit.gov.cn/" target="_blank" rel="nofollow noopener">
        蜀ICP备2021029058号
      </a>
    </span>
    
      
        <span>
          <a
            href="http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=51011202000479"
            rel="nofollow noopener"
            class="beian-police"
            target="_blank"
          >
            
              <span style="visibility: hidden; width: 0">|</span>
              <img src="/img/beian.png" srcset="/img/loading.gif" lazyload alt="police-icon"/>
            
            <span>川公网安备 51011202000479号</span>
          </a>
        </span>
      
    
  </div>


  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  




  <script defer src="/js/leancloud.js" ></script>



  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
      typing(title)
      
    })(window, document);
  </script>









  <script  src="https://cdn.jsdelivr.net/npm/mermaid@8/dist/mermaid.min.js" ></script>
  <script>
    if (window.mermaid) {
      mermaid.initialize({"theme":"default"});
    }
  </script>




  

  

  

  

  

  




  
<script src="//cdn.jsdelivr.net/npm/aplayer@1.10.0/dist/APlayer.min.js"></script>
<script src="//cdn.jsdelivr.net/npm/meting@2.0.1/dist/Meting.min.js"></script>
<script src="/xm_custom/custom.js"></script>



<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


</body>
</html>
